msserver...wtf?

just noticed thei entry in startup. i see several mentions using google, but no clear solution for it's removal (referenced as malware). if keeps coming back after unchecking it in msconfig/startup, and rebooting. spybot and adaware show clean, and nod...well, i don't expect it to really do anything in a situation like this. anybody have a fix?
thanks

 

And its name is just "msserver"? Nothing else?

 

yep. a variant of vundo. after several passes of "super anti spyware", it's still on the system. looks like a lengthy backup and reformat tonight...

 

Not "msserver.exe", or "msserver...wtf", then?
Have a try with MBAM, and/or try both SAS and MBAM in safe mode.
When MBAM scans, it may prompt to restart, in order to remove locked files during reboot. If it so prompts, reboot straight away.

 

got a copy of mbam? their ftp is down...i'll try in safe mode w/ the sas...thanks

 

MalwareBytes.org working fine, here, try from MajorGeeks

 

thanks man. it appears, after doing a scan in safe mode, the sas app removed the startup entry. i'll do a rescan, as i hope that that was not all that was removed. thanks again for the help. moral: this is what can happen (malware) when downloading apps through p2p/torrents. this (digital photography software) was a very recent one, by the way...

 

mbam found 2 more instances of vundo. after deletion of these, and another run of mbam...big badda boom! no bugs! very happy camper here. thanks again

 

Glad it's fixed, but if you want to download applications via p2p, cracked warez etc, that's what you're going to get.
There's plenty of freeware available for many applications (anti malware, for example ) that works very well.

 

oh, and latest nod32 defs now detect it